The present invention relates to storage control apparatus with ANSIX3T11-standardized fiber channels as an interface with its upper-level or “host” computers, and more particularly to a storage controller device which is employable in a computer system including a host computer and a storage control device plus a storage unit operable under control of the storage controller and which is for elimination of unauthorized access attempts upon issuance of a request to access the storage unit as sent from the host computer to the storage controller.
Conventionally, with regard to elimination or determent of unauthorized or illicit access attempts over networks, a variety of approaches are known and proposed until today.
One typical prior known approach to deterring unauthorized access has been disclosed in Published Unexamined Japanese Patent Application (“PUJPA”) No. 3-152652, wherein a network security system between computer systems supporting the TCP/IP protocol includes a memory device for storage of predefined identification (ID) information of those users who are authorized to log-in the network. The security system has a function of interrupting or disenabling any connection to the network whenever an unauthorized person attempts to log-in the network for invasion or “hacking” purposes.
Another approach has been disclosed in PUJPA No. 63-253450, wherein the central processing device disclosed comes with an operating system that is designed to monitor or “pilot” entry of user ID, password and online address data thereby deterring any unauthorized access to resource files on disk drive units.
Still another approach is based on the “ESCON” interface architecture available from IBM corp., which is designed so that by utilizing the fact that a host computer stores therein a logical address thereof as the source address of the host computer in the form of a frame and transmits the same to a storage controller device, the storage controller has a function of checking whether an incoming logical address in such frame matches a logical address that has been preset in the storage controller.
Any one of the prescribed prior art approaches are not more than a mere unauthorized access elimination means that is inherently directed to those interfaces with a single type of layer mounted on a host logical layer.
However, the ANSIX3T11-standardized fiber channel is the “network type” architecture, which is capable of providing the host logical layer with various built-in layers mountable thereon, such as for example TCP/IP, SCSI, ESCON, IPI and the like. More specifically, since the buffer contents are to be moved from one device to another in a way independent of the data format and contents, it may offer logical compatibility with other interface configurations and therefore remain physically accessible without suffering from any particular limitations. Especially, in a storage system including this fiber channel and a storage device with a plurality of storage regions such as a disk array device or “subsystem,” the storage regions are usable in common by an increased number of host computers. Accordingly, the prior art unauthorized access determent schemes remain insufficient in performance and reliability. A need thus exists for achievement of secrecy protection based on users' intentional security setup.